Privacy Policy

Who we are

Image Registrars Limited ("Image Registrars", "we", "us") is a share registrar in Kenya. We keep the share registers of companies ("issuers") and run the Investor Portal website and mobile app ("the Portal") so that their shareholders can see and manage their holdings.

For your Portal account and the information you give us through the Portal, we are the data controller under Kenya's Data Protection Act, 2019. The share register itself belongs to the issuer: we keep it on the issuer's behalf, as its data processor.

You can reach us at:

• Address: 5th Floor, Absa Towers, Loita Street, P.O. Box 9287-00100 GPO, Nairobi, Kenya
• Phone: +254 709 170 000
• Email: info@image.co.ke (please write "Data protection" in the subject line)
• Website: www.image.co.ke

What we collect

We collect what you give us, what the issuer's register already holds about you, and a small amount of technical data when you use the Portal:

• Account: your email address, mobile number and preferred language. Your password is held by Microsoft's sign-in service, which signs you in for us; we never see it.
• Identity: your full name, nationality, national ID or passport number, date of birth and address, and a company's registration number when you act for a company.
• Documents: copies of your ID or passport and proof of address, and the documents that show your right to act for a holding, such as a board resolution, a grant of probate or letters of administration, a power of attorney, a birth or death certificate, or a joint-account statement.
• Holdings: your CDSC account number and the shares, dividends and payments recorded against you on the issuer's register.
• Profile: your gender, marital status, KRA PIN, occupation, employer, source of funds, whether you are a politically exposed person, county and constituency, and your next of kin (name, relationship, phone number, ID or passport number and share of entitlement).
• Payment details: the bank account or mobile money number your dividends are paid to.
• Disability (optional): whether you have a disability, its type and any accommodation you need. This is sensitive personal data. You choose whether to give it, and you can change your answer at any time.
• Requests and messages: the inquiries, transfers, amendments and UFAA letter requests you send, approvals by joint holders, and the messages and files exchanged with our staff.
• Device and security data: the kind of device you use, the app's notification token, the IP address and browser or app details of sign-ins and important actions, and the one-time codes we send to confirm your phone number or a sensitive change. We store those codes only in scrambled (hashed) form, and they expire within minutes.

How we use it, and why we are allowed to

• To run your account: creating it, signing you in and keeping it secure. We need this to provide the Portal to you.
• To verify you: checking your identity and documents and matching you to the register before we show you any holding. The law requires this (the Proceeds of Crime and Anti-Money Laundering Act, 2009 and capital markets rules), and it protects you from someone else claiming your shares.
• To handle your requests: reviewing and processing inquiries, transfers, amendments and UFAA letters, and updating the register on the issuer's instructions.
• To pay dividends: paying the account you nominate, deducting tax using your KRA PIN as the Income Tax Act requires, and remitting unclaimed dividends to the Unclaimed Financial Assets Authority (UFAA) as the Unclaimed Financial Assets Act, 2011 requires.
• To keep you informed: sending verification codes, request updates and dividend notices by email, SMS and app notification. These are part of the service.
• To share announcements: sending AGM notices and other issuer announcements on the channels you allow. You can switch channels off, or unsubscribe from all announcements, under Communication preferences.
• To protect the Portal: keeping an audit trail, detecting fraud and misuse, and fixing problems. This is in our legitimate interest and yours, and is sometimes required by law.
• Disability details: only with your explicit consent, and only to make the accommodation you ask for.

Our staff make every decision about your identity and your requests; we do not make decisions about you by automated means alone. We do not sell your data or use it for advertising.

Who we share it with

We share your data only where we need to, and only what is needed:

• The issuer: the company whose shares you hold, which owns its register.
• Joint holders: if you hold shares jointly, the other holders see requests on that holding, including your name, and are asked to approve them.
• Market institutions: the Central Depository and Settlement Corporation (CDSC), and your stockbroker or custodian, where a request needs them.
• Payment providers: the banks and mobile money providers that pay your dividends.
• Authorities: the Kenya Revenue Authority, UFAA, the Capital Markets Authority, courts and law enforcement, where the law requires it.
• Our service providers: Microsoft (Azure hosting and sign-in), Twilio SendGrid (email), Africa's Talking (SMS) and Google Firebase (app notifications). They process data only on our instructions and under contracts that require them to protect it.

Where your data is stored

The Portal and its databases are hosted on Microsoft Azure in South Africa. Some of our service providers process data in other countries, including the United States, to send emails and app notifications. We transfer data outside Kenya only with the safeguards the Data Protection Act, 2019 requires, such as contracts that protect it and providers with recognised security standards.

How long we keep it

• Share register and dividend records: for as long as the issuer and the law require. These are permanent company records.
• Identity checks, documents, requests and messages: while you have an account, and afterwards for at least seven years, as anti-money-laundering law requires.
• App and website notifications: deleted automatically within 90 days.
• Security and audit records: as long as needed to protect the Portal and to meet our legal obligations.

When we no longer need data, we delete it or make it anonymous.

How we protect it

All connections to the Portal are encrypted, and our databases are encrypted at rest. Sign-in is handled by Microsoft's identity service, sensitive changes need a one-time code, staff see only what their role needs, and we keep a record of who did what. On the mobile app your sign-in is kept in your phone's secure storage.

We will never ask for your password or a one-time code by phone, SMS or email. If anyone does, do not share it, and tell us.

Your rights

Under the Data Protection Act, 2019 you have the right to:

• be told how your data is used, which is what this policy is for;
• get a copy of the data we hold about you;
• have wrong or incomplete data corrected. You can update most details yourself in the Portal; changes to the register go through a request;
• have data deleted where we are not required to keep it;
• object to how we use your data, including for announcements;
• withdraw consent you have given, such as for disability details, at any time;
• receive the data you gave us in a common electronic format;
• not be subject to a decision made by automated means alone.

To use any of these rights, email info@image.co.ke with "Data protection" in the subject line, or write to us. We may first need to confirm your identity, and we will reply within the time the law sets.

You can delete your Portal account yourself at any time, in your account settings on the website or under Settings in the app, or ask us to do it for you. Deleting it removes your sign-in and Portal profile; it does not remove you from the issuer's register, or delete records the law requires us to keep.

If you are unhappy with how we have handled your data, you can complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). We would appreciate the chance to put things right first.

Children

The Portal is for adults. A parent or guardian can manage shares held by a child. When they do, we process the child's details, such as their name, date of birth and birth certificate, only for that purpose and with the parent's or guardian's consent.

Cookies and storage on your device

The website uses only the cookies it needs to work: to keep you signed in, to protect forms against forgery, and to remember your language. We do not use advertising or tracking cookies. The mobile app keeps your sign-in in your phone's secure storage and your settings, such as language, on your device.

Changes to this policy

When we change this policy we will post the new version here with a new date. If a change significantly affects how we use your data, we will tell you in the Portal or by email before it takes effect.